sleinen / samplicator

Send copies of (UDP) datagrams to multiple receivers, with optional sampling and spoofing
GNU General Public License v2.0
389 stars 132 forks source link

Src IP or string based filter? #63

Open ksuuk opened 5 years ago

ksuuk commented 5 years ago

Hi,

Scenario - devices are sending syslog and netflow to one samplicator, so one udp port (514) for syslog and one udp port (2500) for netflow. Syslog & netflow saved into same device and also forwarded to two other devices.

Now I have need to forward traffic from only some sender syslog and/or netflow to third device, so samplicator internal filtering would be best for such purpose. Using regex for strings will definitely be (slight)performance issue, but using sender src IP for the filter, should be fine.

Can You please add such functionality?